Daily Digest
The most urgent issue is CVE-2026-85746 in MariaDB (a MySQL fork), a critical memory corruption vulnerability (CVSS 9.9) allowing low-privileged remote attackers to execute code via crafted GIS objects, affecting healthcare systems using MariaDB for clinical data storage. This vulnerability is actively exploited and requires immediate patching to versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, or 13.0.2.
Summary: Memory corruption in ST_AsText GIS function allows low-privileged remote attackers to execute code via crafted GeometryCollections. Requires no authentication and is network-reachable.
Affected Features / Interoperability: GIS functions (ST_AsText), potentially impacting spatial data processing in healthcare applications. Replication and client drivers using GIS features may be affected.
Source: https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85
Actions:
Summary: Use-after-free in SYS_REFCURSOR handling allows low-privileged attackers to execute code by opening many cursors. Network-reachable with low privileges.
Affected Features / Interoperability: Cursor management in stored procedures, potentially affecting batch processing and ETL pipelines in healthcare data workflows.
Source: https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3
Actions:
Summary: Bypass of table-name encoding via #mysql50# prefix allows attackers to access files and execute code. Requires low privileges and is network-reachable.
Affected Features / Interoperability: Table naming conventions, potentially impacting data integrity and access controls in healthcare databases.
Source: https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19
Actions:
Summary: Cross-site scripting in Vitess debug endpoint allows unauthenticated attackers to inject scripts via crafted requests. Affects healthcare systems using Vitess for MySQL clustering.
Affected Features / Interoperability: Vitess HTTP debug endpoints, potentially compromising query and transaction data in clustered environments.
Source: https://github.com/vitessio/vitess/pull/20255
Actions:
Summary: SQL injection in Wheels framework allows attackers to manipulate queries via request data. Affects healthcare applications using Wheels with MariaDB.
Affected Features / Interoperability: Dynamic finders and query builders, potentially exposing patient data or authentication systems.
Source: https://github.com/wheels-dev/wheels/security/advisories/GHSA-96rm-h22v-925x
Actions:
Summary: SQL injection via backslash escaping in Wheels framework allows query manipulation. Affects MariaDB with NO_BACKSLASH_ESCAPES disabled.
Affected Features / Interoperability: Inline SQL literals and LIKE clauses, potentially compromising data integrity in healthcare records.
Source: https://github.com/wheels-dev/wheels/security/advisories/GHSA-mvr9-2h5x-w6cq
Actions:
Summary: Privilege escalation via GRANT PROXY with empty password allows low-privileged attackers to set other users' passwords. Affects healthcare systems with delegated access controls.
Affected Features / Interoperability: GRANT PROXY functionality, potentially compromising user account security.
Source: https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28
Actions:
Summary: SQL injection via crafted identifiers in SHOW CREATE statements allows attackers to inject malicious SQL during dumps. Affects backup and migration processes.
Affected Features / Interoperability: SHOW CREATE SERVER/USER, mariadb-dump, potentially compromising data integrity during backups.
Source: https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13
Actions:
Summary: Unauthenticated JDBC injection allows attackers to connect to arbitrary databases via test endpoint. Affects healthcare systems using AllData for data integration.
Affected Features / Interoperability: JDBC connection testing, potentially exposing backend databases to unauthorized access.
Actions:
Summary: SQL injection in registration form allows remote attackers to manipulate database queries. Affects healthcare training systems using this software.
Affected Features / Interoperability: User registration functionality, potentially exposing patient or staff data.
Source: https://github.com/itsmeravitejak/Online-Examination-System/issues/3
Actions:
Summary: SQL injection in Tianji analytics platform allows authenticated attackers to execute arbitrary queries via timezone parameter. Affects healthcare analytics systems using Tianji.
Affected Features / Interoperability: Timezone handling in analytics queries, potentially exposing credentials and tenant data.
Source: https://github.com/msgbyte/tianji/releases/tag/v1.31.29
Actions:
Summary: Unauthenticated SQL injection in SOAP GetUser method allows attackers to execute commands via crafted sUserID parameter. Affects healthcare systems using Channel Software WebAlliance.
Affected Features / Interoperability: SOAP web services, potentially compromising entire database backend.
Actions:
Summary: Insecure storage of Telegram session strings in MongoDB allows attackers to recover authenticated sessions. Affects healthcare systems using Telegram for communications.
Affected Features / Interoperability: Session storage in MongoDB, potentially compromising secure communications.
Source: https://www.vulncheck.com/advisories/telegram-stremio-insecure-session-storage-via-encode-string
Actions:
The most urgent item is CVE-2026-77459 in Argo CD (Kubernetes) with a CVSS score of 9.9, which allows a user who can write to an Application’s Git repository to create a malicious PostDelete hook that bypasses project authorization checks and can delete cluster-scoped resources or persistent hook objects, potentially leading to unauthorized cluster-wide disruption.
Summary: Argo CD versions 2.10.0 through 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 create PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during normal synchronization. An attacker with write access to an Application’s Git repository can inject a delete hook targeting a forbidden namespace, server, group, kind, or resource name; when the Application is deleted, the controller creates the resource using its cluster credentials.
Affected Features / Interoperability: Argo CD controller’s hook processing, cluster-scoped resource management, namespaced allow/deny lists, persistent hook objects, and secondary objects created by hook Jobs.
Source:
Actions:
Summary: In KEDA versions 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can point `hashicorpVault.address` to an attacker‑controlled endpoint and use Kubernetes authentication without supplying explicit credentials. KEDA then sends the operator pod’s projected ServiceAccount token to that endpoint, allowing the attacker to obtain the operator’s cluster‑wide permissions (including broad Secret reads).
Affected Features / Interoperability: KEDA operator, Vault integration, ServiceAccount token usage, Secret access, and any workloads relying on KEDA‑driven autoscaling.
Source:
Actions:
Summary: The Apache CloudStack Kubernetes Service (CKS) plugin from versions 4.21.0.0 through 4.22.1.0 improperly validates tenant boundaries when adding or removing nodes, enabling a user from one tenant to manipulate another tenant’s Kubernetes cluster.
Affected Features / Interoperability: CloudStack CKS plugin, node addition/removal workflows, cross‑tenant isolation, and underlying Kubernetes cluster stability.
Source:
Actions:
Summary: A low‑privileged Kubernetes user can inject arbitrary Jinja2 expressions into custom resource (CR) specification values processed by the Ansible Operator Plugins, leading to remote code execution and privilege escalation within the operator pod’s service account.
Affected Features / Interoperability: Ansible Operator, CR validation, Jinja2 templating, and any automation that relies on the operator’s service account permissions.
Source:
Actions:
Summary: Prior to version 0.58.0, the Radius Kubernetes controller deserializes the user‑controlled `radapp.io/status` annotation on a Deployment and uses its container resource identifier for deletion without confirming ownership, allowing an attacker with annotation‑edit rights to forge a deletion request for another tenant’s Radius‑managed container.
Affected Features / Interoperability: Radius controller, Deployment annotation handling, multi‑tenant container lifecycle, and reconciliation logic.
Source:
Actions:
Summary: In Backstage versions prior to 0.21.8, the `@backstage/plugin-kubernetes-backend` package insufficiently validates entity data supplied to the deprecated Kubernetes services endpoint, allowing an authenticated user with Kubernetes read permissions to access workload metadata beyond their intended scope.
Affected Features / Interoperability: Backstage Kubernetes plugin, deprecated services endpoint, metadata visibility, and any integrations that rely on scoped Kubernetes data.
Source:
Actions:
Summary: Prior to version 0.21.9, the `@backstage/plugin-kubernetes-backend` package discloses sensitive values (e.g., credentials) in Kubernetes resource queries to authenticated users who hold standard Kubernetes read permissions, because the plugin fails to mask certain fields.
Affected Features / Interoperability: Backstage Kubernetes plugin, resource query masking, secret exposure, and any dashboard or API that surfaces Kubernetes data.
Source:
Actions:
Summary: Talos Linux versions before 1.12.9 and 1.13.3 include sensitive fields such as registry authentication and etcfilespecs content in generated support bundles without redacting them, potentially exposing private credentials when bundles are shared.
Affected Features / Interoperability: Talos support bundle generation, registry credential handling, etcfilespecs processing, and any troubleshooting workflow that shares bundles.
Source:
Actions:
Summary: OpenRun versions prior to 0.17.7 insufficiently validate redirect URLs, allowing an attacker to craft a malicious redirect that bypasses restrictions and leads to open‑redirect attacks.
Affected Features / Interoperability: OpenRun redirect handling, URL validation logic, and any downstream services that rely on safe redirects.
Source:
Actions:
Summary: EnergizeLab station‑middleware Docker images (versions 1.6.5‑1.8.2) allow any low‑privilege registered user to read arbitrary files from the server by supplying a controlled file path, exposing middleware files and server secrets.
Affected Features / Interoperability: Middleware file‑read functionality, server secret storage, and any integrations that depend on the middleware’s file access.
Source:
Actions:
Summary: EnergizeLab station‑middleware Docker images (1.6.5‑1.8.2) fail to enforce role checks on administrative APIs, permitting any authenticated low‑privilege user to retrieve AI provider keys and alter configuration or object‑store contents.
Affected Features / Interoperability: Administrative API endpoints, AI provider credential storage, configuration management, and object‑store operations.
Source:
Actions:
Summary: Dockhand versions before 1.0.34 expose an in‑browser container terminal endpoint (`/api/containers/<id>/exec`) that does not authenticate the WebSocket upgrade request, allowing an unauthenticated attacker with network reach to execute arbitrary commands inside a known container.
Affected Features / Interoperability: Dockhand terminal endpoint, WebSocket handling, container exec functionality, and any privileged mounts exposed to the container.
Source:
Actions:
Summary: Dokku versions prior to 0.38.25 allow a user with app‑level access and remote SSH to store arbitrary strings via the docker‑options plugin; those strings are later concatenated into `DOCKER_ARGS` and processed by Bash `eval`, enabling arbitrary command execution as the dokku OS user.
Affected Features / Interoperability: Dokku docker‑options plugin, build/deploy/run command construction, Bash argument processing, and host‑level privilege escalation paths.
Source:
Actions:
Summary: Blinko through version 1.8.8 is vulnerable to directory traversal via the `installPlugin` procedure; an authenticated user can supply a plugin name containing `../` sequences to write files outside the plugins directory. Because the official Docker image runs as root, this can overwrite root‑owned startup files and achieve remote code execution.
Affected Features / Interoperability: Blinko plugin installation logic, file‑system path handling, Docker image user privilege (root), and startup script integrity.
Source:
Actions:
Summary: In Arcane versions before 2.6.0, the `UpdateUser` function sets a password hash for any target user without verifying the caller’s privileges, allowing a holder of the `users:update` permission to change the global administrator’s password and gain full administrative control.
Affected Features / Interoperability: Arcane user‑management API, password‑change flow, privilege validation, and administrative account security.
Source:
Actions: